diff --git a/pcapkit/corekit/fields/collections.py b/pcapkit/corekit/fields/collections.py
index ae0c7ec202..cbe2e06def 100644
--- a/pcapkit/corekit/fields/collections.py
+++ b/pcapkit/corekit/fields/collections.py
@@ -6,6 +6,7 @@
 from typing import TYPE_CHECKING, Generic, TypeVar, cast
 
 from pcapkit.corekit.fields.field import FieldBase
+from pcapkit.corekit.fields.numbers import NumberField
 from pcapkit.corekit.multidict import OrderedMultiDict
 from pcapkit.utilities.compat import List
 from pcapkit.utilities.exceptions import FieldValueError
@@ -178,6 +179,29 @@ class OptionField(ListField, Generic[_TS]):
     This field is used to represent a list of fields, as in the case of lists of
     options and/or parameters in a protocol.
 
+    Note:
+        :meth:`self.unpack <unpack>` selects an option's schema by reading the
+        ``type_name`` field of ``base_schema`` **alone** off the front of the
+        option, instead of unpacking the whole base schema and keeping only that
+        one value. That is only the same read when three things hold of the type
+        field:
+
+        1. it is the base schema's **first** field, so that it is what sits at the
+           front of the option;
+        2. it is a :class:`~pcapkit.corekit.fields.numbers.NumberField`, so that
+           :meth:`Schema.unpack <pcapkit.protocols.schema.schema.Schema.unpack>`
+           reads it through its ordinary per-field branch;
+        3. its length is a fixed integer rather than a callable, so that its width
+           does not depend on packet data the shortcut has not read.
+
+        All of that is true of every ``OptionField`` declared in this package. A
+        base schema registered from outside it -- c.f.
+        :mod:`pcapkit.foundation.registry` -- need not satisfy it, and is **not**
+        rejected: such a base schema is unpacked in full, exactly as it was before
+        the shortcut existed. It parses correctly and pays the cost of the second
+        parse. Only the shortcut is withheld, so a base schema whose type field
+        comes second cannot be silently misread.
+
     """
 
     @property
@@ -228,6 +252,34 @@ def __init__(self, length: 'int | Callable[[dict[str, Any]], int]' = lambda _: -
             raise FieldValueError('Field <option> has no registry.')
         self._registry = registry
 
+        # NOTE: Decided once, here, rather than per option in ``unpack``. See the
+        # docstring above for what the fast path requires and why a base schema
+        # that does not meet it is accommodated rather than rejected.
+        #
+        # The three conditions are exactly what makes reading the type field alone
+        # the same read that ``Schema.unpack`` performs for it: it must sit at the
+        # front of the option, ``Schema.unpack`` must handle it through its generic
+        # branch rather than one of the special ones (a ``NumberField`` is never
+        # ``PayloadField``, ``PaddingField``, ``ConditionalField``,
+        # ``ForwardMatchField``, ``SwitchField`` or ``OptionField``), and its width
+        # must not depend on packet state that the full unpack would have
+        # established first.
+        #
+        # Every test is written so that an unexpected base schema selects the full
+        # unpack instead of raising, so this cannot turn a registration that works
+        # today into an import-time failure.
+        fields = getattr(self._base_schema, '__fields__', {})
+        type_field = fields.get(type_name)
+
+        #: Optional[FieldBase]: Base schema's type field, when reading it on its own
+        #: is equivalent to unpacking the whole base schema to obtain it; otherwise
+        #: :data:`None`, and :meth:`self.unpack <unpack>` unpacks the base schema.
+        self._type_field = type_field if (
+            isinstance(type_field, NumberField)
+            and list(fields)[:1] == [type_name]
+            and type_field._length_callback is None  # pylint: disable=protected-access
+        ) else None
+
     def unpack(self, buffer: 'bytes | IO[bytes]', packet: 'dict[str, Any]') -> 'list[_TS]':
         """Unpack field value from :obj:`bytes`.
 
@@ -256,15 +308,47 @@ def unpack(self, buffer: 'bytes | IO[bytes]', packet: 'dict[str, Any]') -> 'list
         new_packet = packet.copy()
         new_packet[self.name] = OrderedMultiDict()
 
+        # NOTE: Where it can, this reads the base schema's type field alone rather
+        # than the whole base schema. The option schema below re-reads the same
+        # octets from the rewound stream, and the base schema's result is used for
+        # nothing but the type code, so unpacking it in full parsed every option
+        # twice -- 2274 schema unpacks for 1137 options of
+        # ``examples/captures/profile.pcapng``.
+        #
+        # Reading the type field alone deliberately mirrors what
+        # :meth:`Schema.unpack <pcapkit.protocols.schema.schema.Schema.unpack>`
+        # does for one field -- ``field(packet)``, read ``field.length`` octets,
+        # then ``field.unpack(byte, packet.copy())`` -- rather than reaching for
+        # :func:`struct.unpack`. That keeps ``code``'s enumeration type, which both
+        # the ``self._eool`` comparison and the ``OrderedMultiDict`` key depend on,
+        # and it is what makes the two spellings equivalent rather than merely
+        # similar.
+        #
+        # ``self._type_field`` is :data:`None` for a base schema that the shortcut
+        # does not fit -- see the class docstring -- and the full unpack is used
+        # for it instead. Whichever way the code was read, ``consumed`` is the
+        # number of octets to rewind to get back to the front of the option.
+        type_field = self._type_field
+
         temp = []  # type: list[_TS]
         while length > 0:
-            # unpack option type using base schema
-            meta = self._base_schema.unpack(file, length, packet)  # type: ignore[call-arg,misc,var-annotated]
-            code = cast('int', meta[self._type_name])
+            if type_field is None:
+                # unpack option type using base schema
+                meta = self._base_schema.unpack(file, length, packet)  # type: ignore[call-arg,misc,var-annotated]
+                code = cast('int', meta[self._type_name])
+                consumed = len(meta)
+            else:
+                # unpack option type using the base schema's type field. No cast
+                # is needed here, unlike the branch above: the type field is known
+                # to be a ``NumberField``, so ``unpack`` is already typed ``int``.
+                field = type_field(packet)
+                byte = file.read(field.length)
+                code = field.unpack(byte, packet.copy())
+                consumed = len(byte)
             schema = self._registry[code]
 
             # rewind to the beginning of the option
-            file.seek(-len(meta), io.SEEK_CUR)
+            file.seek(-consumed, io.SEEK_CUR)
 
             # unpack option using option schema
             data = schema.unpack(file, length, packet)  # type: ignore[call-arg,misc,var-annotated]
diff --git a/pcapkit/dumpkit/pcap.py b/pcapkit/dumpkit/pcap.py
index 546bac7037..6dd470cf93 100644
--- a/pcapkit/dumpkit/pcap.py
+++ b/pcapkit/dumpkit/pcap.py
@@ -9,12 +9,12 @@
 :mod:`dictdumper`.
 
 """
+import struct
 import sys
 from typing import TYPE_CHECKING
 
 from pcapkit.dumpkit.common import DumperBase as Dumper
 from pcapkit.protocols.data.misc.pcap.header import Header as Data_Header
-from pcapkit.protocols.misc.pcap.frame import Frame
 from pcapkit.protocols.misc.pcap.header import Header
 
 if TYPE_CHECKING:
@@ -31,6 +31,23 @@
     'PCAPIO',
 ]
 
+#: Per-byte-order record header packers for the four ``uint32`` fields of a PCAP
+#: record header -- ``ts_sec``, ``ts_usec``, ``incl_len``, ``orig_len``. Keyed by
+#: the byte order of the global header this dumper wrote, so that the records
+#: agree with the magic number a reader will find in front of them.
+_RECORD_HEADER = {
+    'little': struct.Struct('<IIII'),
+    'big': struct.Struct('>IIII'),
+}
+
+#: Truncation mask for those four fields. :class:`~pcapkit.corekit.fields.numbers.UInt32Field`,
+#: which used to pack them, masks to the field width in
+#: :meth:`~pcapkit.corekit.fields.numbers.NumberField.pre_process` rather than
+#: rejecting an out-of-range value -- a ``ts_sec`` of ``2**32 + 5`` was written as
+#: ``5``. :func:`struct.pack` raises instead, so the mask is applied here to keep
+#: the two spellings writing the same octets for every input.
+_UINT32_MASK = 0xFFFF_FFFF
+
 
 class PCAPIO(Dumper):
     """PCAP file dumper.
@@ -46,6 +63,8 @@ class PCAPIO(Dumper):
     if TYPE_CHECKING:
         #: PCAP file global header.
         _ghdr: 'Data_Header'
+        #: Record header packer, in the global header's byte order.
+        _rechdr: 'struct.Struct'
 
     ##########################################################################
     # Properties.
@@ -75,6 +94,11 @@ def __init__(self, fname: 'str', *, protocol: 'Enum_LinkType | StdlibIntEnum | A
         """
         #: int: Frame counter.
         self._fnum = 1
+        # NOTE: Both of these now only record how the dumper was configured -- the
+        # values that shape the output reach it through :meth:`self._dump_header
+        # <_dump_header>`'s own arguments, and are readable afterwards from
+        # :attr:`self._ghdr <_ghdr>`. They are kept because they are part of the
+        # instance surface a subclass may already read.
         #: bool: Nanosecond-resolution file flag.
         self._nsec = nanosecond
         #: Enum_LinkType | StdlibIntEnum | AenumIntEnum | str | int: Data link type.
@@ -123,6 +147,13 @@ def _dump_header(self, *, protocol: 'Enum_LinkType | StdlibIntEnum | AenumIntEnu
             file.write(packet)
         self._ghdr = header.info
 
+        #: struct.Struct: Packer for the record header preceding each frame, in the
+        #: byte order of the global header just written. Taken from
+        #: :attr:`self._ghdr <_ghdr>` rather than from the ``byteorder`` argument
+        #: because :class:`~pcapkit.protocols.misc.pcap.header.Header` is what
+        #: validates and normalises it.
+        self._rechdr = _RECORD_HEADER[self._ghdr.magic_number.byteorder]
+
     def _append_value(self, value: 'Data_Frame', file: 'IO[bytes]', name: 'str') -> 'None':  # pylint: disable=unused-argument
         """Call this function to write contents.
 
@@ -131,14 +162,35 @@ def _append_value(self, value: 'Data_Frame', file: 'IO[bytes]', name: 'str') ->
             file: output file
             name: name of current content block
 
+        Notes:
+            A PCAP record is a 16-octet header followed by the packet octets, and
+            both are already in hand: the header fields are exactly
+            ``value.frame_info`` and the octets are exactly ``value.packet``. So
+            this writes them directly, rather than handing them to
+            :class:`~pcapkit.protocols.misc.pcap.frame.Frame`, whose constructor
+            packs the record and then **dissects it again** through the whole
+            protocol stack to arrive at bytes it was given. That round trip was
+            about 82% of the cost of a flow-traced extraction -- ``http.pcap``,
+            1117 frames, best of 7: 2319 ms with the rebuild against 1263 ms
+            without, over a 1030 ms untraced baseline.
+
+            Dropping it is not only cheaper. The re-dissection re-emitted every
+            parse warning the frame had already produced once, and warned about
+            payloads it had no business parsing at all -- writing a 3-octet
+            payload raised ``SchemaWarning: packet length < 0: -3`` from a dumper
+            that only had to copy it.
+
         """
-        packet = Frame(
-            nanosecond=self._nsec,
-            num=self._fnum,
-            proto=self._link,
-            packet=value.packet,
-            header=self._ghdr,
-            **value.frame_info,
-        ).data
-        file.write(packet)
+        # NOTE: The payload is read before the metadata so that a caller passing a
+        # mapping rather than a dissected frame -- which the flow-tracing adapters
+        # of several engines do -- still fails naming ``packet``, as the ``Frame``
+        # construction did. :mod:`pcapkit.foundation.extraction` substitutes a
+        # dict-capable trace format on the strength of that error.
+        packet = value.packet
+        frame_info = value.frame_info
+
+        file.write(self._rechdr.pack(frame_info.ts_sec & _UINT32_MASK,
+                                     frame_info.ts_usec & _UINT32_MASK,
+                                     frame_info.incl_len & _UINT32_MASK,
+                                     frame_info.orig_len & _UINT32_MASK) + packet)
         self._fnum += 1
diff --git a/tests/corekit/test_fields_collections.py b/tests/corekit/test_fields_collections.py
new file mode 100644
index 0000000000..7710b40115
--- /dev/null
+++ b/tests/corekit/test_fields_collections.py
@@ -0,0 +1,318 @@
+from __future__ import annotations
+
+import collections
+import unittest
+from typing import TYPE_CHECKING
+
+from tests._support import purge_modules
+
+if TYPE_CHECKING:
+    from typing import Any
+
+
+class OptionFieldTests(unittest.TestCase):
+    """Option-list parsing by :class:`~pcapkit.corekit.fields.collections.OptionField`.
+
+    The schemas below stand in for the real TLV protocols: a base schema holding
+    the option type and length, and two option schemas of *different* total
+    widths registered against it, so that a stream left in the wrong place by
+    the type lookup shows up as the second option decoding wrongly rather than
+    as a silent shift.
+
+    """
+
+    def setUp(self) -> None:
+        purge_modules(['pcapkit'])
+
+        from pcapkit.corekit.fields.collections import OptionField
+        from pcapkit.corekit.fields.numbers import UInt16Field
+        from pcapkit.corekit.fields.strings import BytesField, PaddingField
+        from pcapkit.protocols.schema.schema import Schema, schema_final
+
+        #: Every schema unpacked while parsing an option list, in order.
+        self.unpacked = []  # type: list[str]
+        unpacked = self.unpacked
+
+        class Base(Schema):
+            """Base schema: a two-octet type, then a two-octet body length."""
+
+            kind: 'int' = UInt16Field()
+            size: 'int' = UInt16Field()
+
+            @classmethod
+            def pre_unpack(cls, packet: 'dict[str, Any]') -> 'None':
+                unpacked.append(cls.__name__)
+
+        @schema_final
+        class Body(Base):
+            """An option carrying ``size`` octets of body after the header."""
+
+            body: 'bytes' = BytesField(length=lambda pkt: pkt['size'])
+
+        @schema_final
+        class End(Base):
+            """The end-of-option-list marker: header only, no body."""
+
+        registry = collections.defaultdict(
+            lambda: Body, {1: Body, 0: End},
+        )  # type: collections.defaultdict[int, type[Base]]
+
+        @schema_final
+        class Options(Schema):
+            options: 'list[Base]' = OptionField(
+                length=13, base_schema=Base, type_name='kind',
+                registry=registry, eool=0,
+            )
+            pad: 'bytes' = PaddingField(
+                length=lambda pkt: pkt.get('__option_padding__', 0),
+            )
+
+        self.Base = Base
+        self.Body = Body
+        self.End = End
+        self.Options = Options
+
+        #: A 7-octet ``Body`` option, then a 4-octet ``End``, then 2 spare
+        #: octets inside the field's declared 13.
+        self.buffer = b'\x00\x01\x00\x03abc' b'\x00\x00\x00\x00' b'\xde\xad'
+
+    def test_each_option_is_unpacked_exactly_once(self) -> None:
+        """Selecting an option schema must not parse the option first.
+
+        Reading the option type by unpacking the whole base schema and throwing
+        the result away parsed every option twice -- two schema unpacks per
+        option, the first of which was used for nothing but its type field. The
+        base schema must therefore not appear here at all, and each option
+        schema exactly once.
+
+        """
+        self.Options.unpack(self.buffer, 13, {})
+
+        self.assertEqual(self.unpacked, ['Body', 'End'])
+
+    def test_options_of_differing_widths_parse_in_sequence(self) -> None:
+        """The stream must be left exactly at each option's first octet."""
+        options = self.Options.unpack(self.buffer, 13, {}).options
+
+        self.assertEqual([type(opt).__name__ for opt in options], ['Body', 'End'])
+        self.assertEqual(options[0].kind, 1)
+        self.assertEqual(options[0].size, 3)
+        self.assertEqual(options[0].body, b'abc')
+        self.assertEqual(options[1].kind, 0)
+
+    def test_the_area_left_unread_after_the_eool_is_reported_as_padding(self) -> None:
+        """The area past the end-of-option-list marker is handed back.
+
+        ``OptionField`` reports it through ``__option_padding__``, which is what
+        the following field sizes itself from -- so the two spare octets landing
+        in ``pad`` is the whole rewind-and-truncate arithmetic being right.
+
+        """
+        schema = self.Options.unpack(self.buffer, 13, {})
+
+        self.assertEqual(schema.pad, b'\xde\xad')
+
+
+class OptionFieldForeignBaseSchemaTests(unittest.TestCase):
+    """Base schemas that the read-the-type-field-only shortcut does not fit.
+
+    Nothing in this package declares one -- all 34 ``OptionField`` declarations put
+    the type field first as a fixed-width number -- but ``OptionField`` is public
+    and :mod:`pcapkit.foundation.registry` invites third-party protocols to
+    register their own base schemas, which need not.
+
+    Such a base schema must be **unpacked in full**, as it was before the shortcut
+    existed. Getting this wrong does not raise: reading the wrong octets as the type
+    code selects the wrong option schema and the packet is silently misparsed, which
+    is why each case below asserts the parsed result and not merely that the slow
+    path ran.
+
+    """
+
+    def setUp(self) -> None:
+        purge_modules(['pcapkit'])
+
+        #: Every schema unpacked while parsing an option list, in order. The base
+        #: schema appearing here is what distinguishes the full unpack from the
+        #: shortcut.
+        self.unpacked = []  # type: list[str]
+
+    def _options_for(self, base: 'Any', body: 'Any', end: 'Any') -> 'Any':
+        """Wrap a base schema and its two option schemas in an enclosing schema.
+
+        Args:
+            base: Base schema carrying the option type and body length.
+            body: Option schema for a body-bearing option, code ``1``.
+            end: Option schema for the end-of-option-list marker, code ``0``.
+
+        Returns:
+            The enclosing schema class, ready to unpack an 8-octet option area.
+
+        """
+        from pcapkit.corekit.fields.collections import OptionField
+        from pcapkit.corekit.fields.strings import PaddingField
+        from pcapkit.protocols.schema.schema import Schema, schema_final
+
+        registry = collections.defaultdict(lambda: body, {1: body, 0: end})
+
+        @schema_final
+        class Options(Schema):
+            options: 'list[Any]' = OptionField(
+                length=8, base_schema=base, type_name='kind',
+                registry=registry, eool=0,
+            )
+            pad: 'bytes' = PaddingField(
+                length=lambda pkt: pkt.get('__option_padding__', 0),
+            )
+
+        return Options
+
+    def _type_second(self) -> 'Any':
+        """A base schema whose type field is its *second* field."""
+        from pcapkit.corekit.fields.numbers import UInt16Field
+        from pcapkit.corekit.fields.strings import BytesField
+        from pcapkit.protocols.schema.schema import Schema, schema_final
+
+        unpacked = self.unpacked
+
+        class Base(Schema):
+            """Body length first on the wire, option type second."""
+
+            size: 'int' = UInt16Field()
+            kind: 'int' = UInt16Field()
+
+            @classmethod
+            def pre_unpack(cls, packet: 'dict[str, Any]') -> 'None':
+                unpacked.append(cls.__name__)
+
+        @schema_final
+        class Body(Base):
+            body: 'bytes' = BytesField(length=lambda pkt: pkt['size'])
+
+        @schema_final
+        class End(Base):
+            pass
+
+        return self._options_for(Base, Body, End)
+
+    def _type_first(self, callable_length: 'bool' = False) -> 'Any':
+        """A base schema whose type field is its first field.
+
+        Args:
+            callable_length: Whether the type field's width is a callable rather
+                than a fixed integer.
+
+        Returns:
+            The enclosing schema class, ready to unpack.
+
+        """
+        from pcapkit.corekit.fields.numbers import UInt16Field
+        from pcapkit.corekit.fields.strings import BytesField
+        from pcapkit.protocols.schema.schema import Schema, schema_final
+
+        unpacked = self.unpacked
+        kind_field = UInt16Field(length=lambda pkt: 2) if callable_length else UInt16Field()
+
+        class Base(Schema):
+            """Option type first on the wire, body length second."""
+
+            kind: 'int' = kind_field
+            size: 'int' = UInt16Field()
+
+            @classmethod
+            def pre_unpack(cls, packet: 'dict[str, Any]') -> 'None':
+                unpacked.append(cls.__name__)
+
+        @schema_final
+        class Body(Base):
+            body: 'bytes' = BytesField(length=lambda pkt: pkt['size'])
+
+        @schema_final
+        class End(Base):
+            pass
+
+        return self._options_for(Base, Body, End)
+
+    def test_a_type_field_that_is_not_first_falls_back_to_the_full_unpack(self) -> None:
+        # A ``Body`` option with an empty body, then the end marker. With the type
+        # field second, the first four octets read ``size=0, kind=1``; a reader that
+        # takes the *leading* two octets as the type code sees 0, which is the
+        # end-of-option-list code, so it stops without parsing the option at all --
+        # measured, before the fallback existed: ['End'] and four octets of padding.
+        Options = self._type_second()
+
+        schema = Options.unpack(b'\x00\x00\x00\x01' b'\x00\x00\x00\x00', 8, {})
+
+        self.assertEqual([type(opt).__name__ for opt in schema.options],
+                         ['Body', 'End'])
+        self.assertEqual(schema.options[0].kind, 1)
+        self.assertEqual(schema.pad, b'')
+        # ... and it got there by unpacking the base schema, not by the shortcut
+        self.assertEqual(self.unpacked, ['Base', 'Body', 'Base', 'End'])
+
+    def test_a_type_field_with_a_callable_length_falls_back_to_the_full_unpack(self) -> None:
+        # A callable length is resolved against the packet, and the shortcut runs
+        # before the full unpack has put the base schema's own fields there, so its
+        # width could differ from the one Schema.unpack would have used.
+        Options = self._type_first(callable_length=True)
+
+        schema = Options.unpack(b'\x00\x01\x00\x00' b'\x00\x00\x00\x00', 8, {})
+
+        self.assertEqual([type(opt).__name__ for opt in schema.options],
+                         ['Body', 'End'])
+        self.assertEqual(self.unpacked, ['Base', 'Body', 'Base', 'End'])
+
+    def test_a_plain_first_type_field_still_takes_the_shortcut(self) -> None:
+        # The control: the same construction with the type field first and a fixed
+        # width must *not* fall back, or the guard above would have quietly undone
+        # the optimisation for everything.
+        Options = self._type_first()
+
+        schema = Options.unpack(b'\x00\x01\x00\x00' b'\x00\x00\x00\x00', 8, {})
+
+        self.assertEqual([type(opt).__name__ for opt in schema.options],
+                         ['Body', 'End'])
+        self.assertEqual(self.unpacked, ['Body', 'End'])
+
+
+class OptionFieldPackageDeclarationTests(unittest.TestCase):
+    """Every ``OptionField`` this package declares must still take the shortcut.
+
+    The fallback added for foreign base schemas is selected from the base schema's
+    shape, so a base schema declared here in a shape the shortcut does not fit
+    would silently drop back to parsing every one of its options twice -- correct,
+    but giving up the whole point of the change with nothing to show it. This is
+    the guard against that happening unnoticed.
+
+    """
+
+    def setUp(self) -> None:
+        purge_modules(['pcapkit'])
+
+    def test_no_declaration_in_the_package_falls_back(self) -> None:
+        import pcapkit.all  # noqa: F401  (realises every schema declaration)
+        from pcapkit.corekit.fields.collections import OptionField
+        from pcapkit.protocols.schema.schema import Schema
+
+        def subclasses(cls: 'Any') -> 'Any':
+            for sub in cls.__subclasses__():
+                yield sub
+                yield from subclasses(sub)
+
+        fell_back = []  # type: list[str]
+        total = 0
+        for cls in set(subclasses(Schema)):
+            for name, field in getattr(cls, '__fields__', {}).items():
+                if not isinstance(field, OptionField):
+                    continue
+                total += 1
+                if field._type_field is None:  # pylint: disable=protected-access
+                    fell_back.append(f'{cls.__module__}.{cls.__name__}.{name}')
+
+        self.assertGreater(total, 0, 'no OptionField declarations were found, so '
+                                     'this test proves nothing')
+        self.assertEqual(sorted(fell_back), [])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/dumpkit/test_common_unit.py b/tests/dumpkit/test_common_unit.py
index 89de1be39f..b1dc042033 100644
--- a/tests/dumpkit/test_common_unit.py
+++ b/tests/dumpkit/test_common_unit.py
@@ -7,10 +7,12 @@
 import io
 from ipaddress import ip_address
 import pathlib
+import struct
 import tempfile
 import types
 import unittest
 from unittest import mock
+import warnings
 
 from tests._support import purge_modules
 
@@ -154,6 +156,117 @@ def test_null_dumper_noops_and_pcap_dumper_writes_file(self) -> None:
             self.assertIs(dumper(frame), dumper)
             self.assertGreater(pcap_path.stat().st_size, header_size)
 
+    def test_pcap_dumper_writes_the_record_header_in_the_global_header_byte_order(self) -> None:
+        # The dumper writes the 16-octet record header itself instead of building a
+        # Frame to pack it, so the byte order of those four uint32 fields is now this
+        # module's responsibility rather than the schema's. It has to match the magic
+        # number in front of them, and 'big' has to keep working on a little-endian
+        # host -- which is exactly what a struct format hardcoded to one endianness
+        # would silently get wrong.
+        #
+        # Values are chosen to be byte-order-visible: every field is asymmetric, so a
+        # wrong endianness cannot coincide with a right one.
+        from pcapkit.const.reg.linktype import LinkType
+        from pcapkit.dumpkit.pcap import PCAPIO
+        from pcapkit.protocols.data.misc.pcap.frame import Frame, FrameInfo
+
+        payload = bytes(range(6))
+        for byteorder, endian in (('little', '<'), ('big', '>')):
+            for nanosecond in (False, True):
+                with self.subTest(byteorder=byteorder, nanosecond=nanosecond):
+                    with tempfile.TemporaryDirectory() as tempdir:
+                        path = pathlib.Path(tempdir) / 'sample.pcap'
+                        dumper = PCAPIO(str(path), protocol=LinkType.ETHERNET,
+                                        byteorder=byteorder, nanosecond=nanosecond)
+                        header_size = path.stat().st_size
+
+                        frame = Frame(
+                            frame_info=FrameInfo(ts_sec=0x01020304, ts_usec=0x05060708,
+                                                 incl_len=len(payload), orig_len=0x0A0B0C0D),
+                            time='time', number=1, time_epoch=1.25,
+                            len=len(payload), cap_len=0x0A0B0C0D,
+                        )
+                        frame.__update__(packet=payload)
+                        dumper(frame)
+
+                        self.assertEqual(
+                            path.read_bytes()[header_size:],
+                            struct.pack(f'{endian}IIII', 0x01020304, 0x05060708,
+                                        len(payload), 0x0A0B0C0D) + payload,
+                        )
+
+    def test_pcap_dumper_truncates_an_out_of_range_record_field(self) -> None:
+        # UInt32Field, which used to pack these four fields, masks to the field width
+        # in NumberField.pre_process instead of rejecting an out-of-range value, so
+        # the dumper silently wrote a wrapped one. struct.pack raises on the same
+        # input, so writing the header directly would have turned a written -- if
+        # wrong -- record into a struct.error. Pinned so the mask is not mistaken for
+        # dead defensiveness and dropped: this is behaviour being preserved, not
+        # behaviour being chosen.
+        from pcapkit.const.reg.linktype import LinkType
+        from pcapkit.dumpkit.pcap import PCAPIO
+        from pcapkit.protocols.data.misc.pcap.frame import Frame, FrameInfo
+
+        with tempfile.TemporaryDirectory() as tempdir:
+            path = pathlib.Path(tempdir) / 'sample.pcap'
+            dumper = PCAPIO(str(path), protocol=LinkType.ETHERNET,
+                            byteorder='little', nanosecond=False)
+            header_size = path.stat().st_size
+
+            frame = Frame(
+                frame_info=FrameInfo(ts_sec=2 ** 32 + 5, ts_usec=7,
+                                     incl_len=2, orig_len=2),
+                time='time', number=1, time_epoch=1.0, len=2, cap_len=2,
+            )
+            frame.__update__(packet=b'ab')
+            dumper(frame)
+
+            self.assertEqual(path.read_bytes()[header_size:],
+                             struct.pack('<IIII', 5, 7, 2, 2) + b'ab')
+
+    def test_pcap_dumper_appends_each_frame_without_reparsing_it(self) -> None:
+        # Successive frames have to accumulate, and each record has to be the caller's
+        # own octets verbatim -- the dumper no longer round-trips them through a Frame
+        # construction, which packed the record and then dissected it again through
+        # the whole protocol stack to reach bytes it had just been handed.
+        #
+        # The payload here is deliberately not a valid Ethernet frame: under the old
+        # rebuild it was dissected anyway, so a dumper that reparses is not merely
+        # slower but is doing work that can warn or raise on data it only had to copy.
+        from pcapkit.const.reg.linktype import LinkType
+        from pcapkit.dumpkit.pcap import PCAPIO
+        from pcapkit.protocols.data.misc.pcap.frame import Frame, FrameInfo
+
+        def make(number: int, packet: bytes) -> Frame:
+            frame = Frame(
+                frame_info=FrameInfo(ts_sec=number, ts_usec=0, incl_len=len(packet),
+                                     orig_len=len(packet)),
+                time='time', number=number, time_epoch=float(number),
+                len=len(packet), cap_len=len(packet),
+            )
+            frame.__update__(packet=packet)
+            return frame
+
+        with tempfile.TemporaryDirectory() as tempdir:
+            path = pathlib.Path(tempdir) / 'sample.pcap'
+            dumper = PCAPIO(str(path), protocol=LinkType.ETHERNET,
+                            byteorder='little', nanosecond=False)
+            header_size = path.stat().st_size
+
+            with warnings.catch_warnings(record=True) as caught:
+                warnings.simplefilter('always')
+                self.assertIs(dumper(make(1, b'\xff' * 3)), dumper)
+                self.assertIs(dumper(make(2, b'\xfe' * 5)), dumper)
+
+            self.assertEqual(
+                path.read_bytes()[header_size:],
+                struct.pack('<IIII', 1, 0, 3, 3) + b'\xff' * 3
+                + struct.pack('<IIII', 2, 0, 5, 5) + b'\xfe' * 5,
+            )
+            # The frame counter still advances once per frame, and nothing was parsed.
+            self.assertEqual(dumper._fnum, 3)
+            self.assertEqual([str(entry.message) for entry in caught], [])
+
     def test_pcap_dumper_cannot_serialise_a_mapping_frame(self) -> None:
         # Why Extractor substitutes a dict-capable trace format for the DPKT, Scapy,
         # PyShark and PyPCAPFile engines: their flow-tracing adapters report each